Configure Okta SAML SSO
To set up Okta SAML SSO in DronaHQ, you will need:
- An Okta account with permissions to create an SAML integration Application.
- Manage Users access on self-hosted DronaHQ instance or DronaHQ Cloud to configure SSO configurations.
Configure in OKTA
- Navigate to the OKTA dashboard, Go to Admin section. From the left side menu, go to
Applications -> Applications.
Download and open DronaHQ metadata file. To locate this file, Go to
DronaHQ -> Manage Users -> SSO CONFIGURATION -> + Add SSO -> SAML 2.0. Under
Entity ID and Metadata URL, open this url file that will be useful in next steps.
Create App Integrationand configure the app with below field options -
|App Integration Name
|Give a suitable name to your application. Eg -
DronaHQ OKTA SSO.
|(optional) you can provide a logo for your app.
|Single sign-on URL
|It is the location where SAML assertion is sent with an
HTTP POST, known as
SAML Assertion Consumer Service URL. Locate this in the Metadata downloaded and paste it here. Ex - https://studio.dronahq.com/callback/saml
|This, we have to fill with entity ID present in the same Metadata downloaded file. Copy and paste the same. Ex - https://studio.dronahq.com/saml/metadata
|This is an important part where will provide two attributes of name and email with values user.firstname and user.email respectively. You can add other user attributes such as location, department, etc. that you can configure in DronaHQ in next steps
- Click Next. Fill in the feedback form and then
Here we can add all the people related to the organization for the SAML SSO configuration.
- Go to
Assignments -> Assign -> Assign to people -> Click assign for the user -> Done.
Now that we have created our application on Okta for SAML, we will now configure SAML SSO on DronaHQ.
Configure in DronaHQ
In order to configure SAML in DronaHQ, we will need metadata file of OKTA. To get this file from OKTA, Go to
Okta SAML integration and under
Sign on there is
SAML Signing Certificates.
Here we can find all the available active/inactive certificate along with the option to create a new certificate.
Actions -> View IdP Metadata of an active certificate and it will open up a tab with metadata details.
In the same screen, Click on
Actions -> Download certificate and it will download
.cer file that you can keep it for later use.
- Now that we have metadata file, In DronaHQ, Go to
Manage Users -> SSO Configuration -> + ADD SSO -> SAML 2.0
Enter form with below fields -
|Provide Friendly Name of this SSO configuration
|The entity ID is present on Okta metadata file. Copy the ID and paste it.
|Login URL / SSO URL
|Enter the details of location of
singlesignonservice from Okta metadata file for POST method.
|X509 public certificate
|X509Certificate file in
.cer format. This file we have downloaded from OKTA in previous step can be used here.
|Enter domain name for which you want your users to login with for this SSO Configuration. You can add multiple domain names as well. eg -
domain1.com , domain2.com. DronaHQ will automatically redirect to SSO url when we encounter any user’s sign in request with an email id belonging to the given restricted domain.
|Want Auth request signed
|Keep this default setting as
|Add Claim List
|We have already assigned Email and Name on Okta while integrating SAML. We will now enter same key name -
name and map it to
DHQ User Name and
DHQ User Email respectively.
|Enable JIT user provisioning
ON so that you won’t have to manually invite each user to DronaHQ first.
|Enable SCIM User Provisioning
|Enable this in case you want to create, update and deactivate User accounts at your OKTA portal and sync it with DronaHQ user management.
- Save the draft. Again navigate back to the SSO configuration option. You can see the newly created SAML.
- You can click on
Test SSObutton and it will open SSO Login url in a popup window.
- Once you login successfully and if everything is set up correctly, then finally you will see a success message at the bottom.
- Now, that testing is successful, you can click on the more option for above SSO configuration and click on
Activateto make it live.
OKTA SAML in Action
Simply go to DronaHQ End user webapp and enter your email id with domain that matches the configured restricted domain specified in SSO configuration and Click
Instead of asking for password, it asks for Login via Okta SAML SSO provider. Click on it and open a popup window of okta and the user can login with Okta login credentials.
Manage User section on DronaHQ and you will see the new user created since
JIT was enabled.